SimpleSwap

Approval Phishing & Wallet Drainers

A wallet drainer does not need your seed phrase. A malicious approval or signature can give an attacker permission to move tokens from your wallet.

The pattern to remember

Connect wallet
Approve or sign
Permission is authorized
Tokens can move

Some approvals remain active until revoked; signed permissions may also be limited by amount or expiry.

This covers what happens once you sign. For how attackers get you to that screen in the first place, see crypto phishing.

The mechanism isn't exotic. It's a standard token feature, pointed at the wrong contract.

$83.85M

taken from 106,106 wallet-drainer victims in 2025

38%

of 2025 incidents over $1M involved Permit-style approvals

$790

average loss per victim – a volume business, not just whales

What does a token approval actually do?

Approval

You give a smart contract permission to move a specific token from your wallet, up to an allowed amount. That permission can remain active until it is revoked.

Permit

EIP-2612 can create an allowance through a signed message. Permit2 uses signed permissions or transfers after the token has first been approved for the Permit2 contract.

Neither is simply safer: Permit2 avoids piling up forgotten unlimited approvals, but a traditional approval at least shows up as a transaction your wallet makes a fuss about. The risk moves between the two – it does not disappear.

Before you sign

  • Check what permission is being requested.
  • Check which token and amount it covers.
  • Be cautious with unlimited approvals.
  • Do not sign a request you do not understand.

A standard SimpleSwap exchange does not ask you to connect a wallet or sign a token approval. If a page claiming to be SimpleSwap asks for either, stop and verify the site. Verify SimpleSwap

Check and revoke old approvals

  1. 1

    Review your permissions

    Use Revoke.cash, Etherscan's token approval checker, MetaMask Portfolio, or your wallet's own allowance manager – in read-only mode, by pasting your address, if the tool allows it. Type the address by hand or use a bookmark: phishing clones of revocation tools exist too.

  2. 2

    Look for unnecessary access

    Pay particular attention to unlimited allowances and contracts you no longer use or recognize.

  3. 3

    Revoke what you no longer need

    Revocation is an on-chain transaction and usually requires network fees. Check each network separately – an approval from a chain you used once stays live until you remove it.

Disconnecting a wallet is not the same as revoking an approval. The permission remains on-chain until it is explicitly removed.

If you think you signed a malicious approval

Revoke the affected approvals as soon as possible. If you believe the wallet is compromised, move remaining assets to a fresh wallet and preserve transaction IDs and screenshots.

Revoking stops future use of the permission; it does not recover tokens that have already been transferred.

Want the full breakdown?

Read the full guide for a deeper explanation of allowances, Permit signatures, unlimited approvals and how to audit permissions across networks.

Key takeaways

  • A wallet drainer doesn't need your seed phrase – a malicious approval or signature is enough.
  • Unlimited allowances and contracts you don't recognize are the ones worth revoking first.
  • Disconnecting a wallet does not revoke an approval – it stays active on-chain until you remove it.
  • A standard SimpleSwap exchange never asks you to connect a wallet or sign an approval.

Wallet Drainer FAQ

Yes – a crypto drainer doesn't need it. If you grant a malicious token approval or sign a malicious Permit request, an attacker may be able to move the tokens covered by that permission without ever obtaining your seed phrase.

Use Revoke.cash, Etherscan's approval checker or your wallet's built-in allowance manager. Find approvals marked unlimited or belonging to contracts you no longer use, and revoke them – it costs gas, and each network needs to be checked separately.

No. Disconnecting a website from your wallet does not remove permissions stored on-chain. You need to revoke the approval separately.

A standard SimpleSwap exchange does not involve connecting a wallet or signing an approval, so it adds nothing to your approval surface. It also cannot remove allowances you granted elsewhere, and a confirmed transfer cannot be reversed. Our only official domain is simpleswap.io.

Yes. SimpleSwap has processed more than 20M swaps since 2018 without ever requiring a wallet connection or token approval for a standard exchange. If a page or message claiming to be SimpleSwap asks you to connect a wallet and approve a contract, that request itself is the sign it isn't really SimpleSwap.